UCF STIG Viewer Logo

Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-218739 IIST-SI-000206 SV-218739r558649_rule Medium
Description
Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process. In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time. Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166
STIG Date
Microsoft IIS 10.0 Site Security Technical Implementation Guide 2021-12-28

Details

Check Text ( C-20212r311115_chk )
Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the site name.

Click the "Logging" icon.

Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.

If the "Both log file and ETW event" radio button is not selected, this is a finding.

Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting. More configuration information is available at:
https://blogs.intelink.gov/blogs/_disairrt/?p=1317
Fix Text (F-20210r311116_fix)
Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting.

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the site name.

Click the "Logging" icon.

Under Log Event Destination, select the "Both log file and ETW event" radio button.

Select "Apply" from the "Actions" pane.